How does split filtered events processed?

Elastic Stack Logstash
1

Hi,

I am new to this community and come to know about splitting the events into multiple events. Got to know split filter plugin is the answer. I didn't understand the flow of pipeline when using this plugin.

For ex:-

if I have

filter {
    split{}

   mutate{}

   split{}

  mutate{}

}

Will the multiple events cloned from first split will start again from the start i.e. first split or will they continue processing from first mutate call and then further the process again for each filter.

2

The events created from your split filter will enter your pipeline just after the split filter, so the following mutate and all the following filters will process the splitted events.

So if your first split filter split the original event into two new events, the following mutate filter will process those two new events, if your second split filter splits those two new events into another two events each, you will have four events that will be processed by the next mutate in the pipeline.

Logstash is sequential, all the changes from a filter will be available for the next filters in the line.

1 Like
3

Thank you so much for the response.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.